If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (bead18d11dfd3ec4bd14bfa0e950bfa53a8bd30ed66225a3dec3b47b81e5aa16)
The package's postinstall script and its main entrypoint (index.js, byte-identical to callback.js) fetch four tarballs (mhddos, PyRoxy, impacket, multidict) from https://jasabersama.id/assets/cache/.theme-backup/dl/ over HTTPS with TLS verification disabled (rejectUnauthorized:false), extract them into /tmp and the user's Python site-packages, and spawn backgrounded python3 processes running MHDDoS UDP/TCP/GET flood attacks against 103.118.252.21. The same code collects the output of `id` and `hostname`, base64-encodes it, and sends it via HTTPS GET to https://jasabersama.id/portfolio-data.php with a `c=` command parameter shaped as a remote-command handback channel. Because index.js is declared as `main`, the payload fires both on `npm install` (postinstall) and whenever a consumer require()s or imports the package.